API: Account

All endpoints in this section operate on the currently signed-in user.

Current user

GET /api/me

{
  "id": "019f7462-ac2a-73e3-ab40-be2e43f943f9",
  "email": "greta@example.com",
  "firstName": "Greta",
  "lastName": "Lengl",
  "avatarUrl": "/api/avatars/019f7462-ac2a-73e3-ab40-be2e43f943f9?v=3",
  "locale": "de",
  "createdAt": "2025-11-02T09:14:52Z"
}

createdAt is the moment the account was created.

Change the name

PUT /api/me/profile

{ "firstName": "Greta", "lastName": "Lengl" }

Returns 204. Errors: 400 when either field is blank.

Change the password

PUT /api/me/password

{ "currentPassword": "…", "newPassword": "…" }

Returns 204; all other sessions are signed out. Errors: 403 when the current password is wrong, 400 when the new password is invalid (8–72 characters).

Request an email change

POST /api/me/email

{ "newEmail": "new@example.com" }

Returns 202 in every case — the 6-digit confirmation code is only sent when the address is actually usable (anti-enumeration: the response never reveals whether an address is already taken). Errors: 400 for a malformed address.

Confirm the email change

POST /api/me/email/confirm

{ "code": "123456" }

Returns 204: the email address is changed and all other sessions are signed out. Errors: 400 for an invalid or expired code (codes expire after 15 minutes).

Register a device for push

PUT /api/me/push-tokens

{ "platform": "IOS", "token": "<raw APNs device token>" }

Returns 204. Idempotent — registering an already-known token is a no-op, and a token last registered by a different account moves to the caller (a handed-over device must never receive someone else’s notifications). Platforms: IOS (APNs) and ANDROID (FCM). Errors: 400 for a blank or oversized token.

Deregister a device

DELETE /api/me/push-tokens/{token}

Returns 204, also when nothing matched. Only the caller’s own registration is removed. Device tokens are also pruned automatically when Apple reports them dead, and deleted with the account.

Export your data

GET /api/me/export

Returns a JSON document with the account data and all content the user created, delivered as a download (Content-Disposition: attachment) — GDPR data portability.

Delete the account

POST /api/me/delete

{ "password": "…" }

Returns 204 — the account is permanently deleted: the personal workspace, attachments, and profile are erased; tasks the user authored in other people’s shared workspaces remain, attributed to a reserved “Inactive User”. Errors: 403 when the password is wrong, 409 while the user still owns shared workspaces (delete them or transfer ownership first).